Some times when we have a windows server restart we will get old alarms being sent from NTEVL probe.
This scenario applies to NTEVL probes deployed both manually and via Monitoring Profiles
How to we correct this so it does not happen?
All UIM supported verions
NTEVL probe through 4.34 (see notes below for 4.35)
When the probe starts up each time it reads a file called ntevl.pos which has the last read position, so it will start reading where it left off.
Some times on shutting down there will be an error and the counters will be reset
To correct this, you can enable the backup position feature, which saves three backups of the position file in case of corruption, so that a good copy should hopefully always be present.
From the documentation:
ntevl IM Configuration
Enable Position File Backup Interval: allows the probe to back up the position file.
Default: Not selected
Position File Backup Interval: defines the time interval when the probe backs up the position file.
Default: 10 Seconds
Note: The probe keeps the backup of the position file during an unexpected system reboot or system crash. In such cases, reboot alarms occur, but it is possible to get duplicate alarms for the specified time interval.
the keys are:
enable_pos_backupfile = yes
pos_backup_interval = 10
There is a defect in ntevl 4.35 where it fails to create the ntevl.pos file and sends the old alarms on every restart.
This is being investigated, in the meantime downgrading to 4.34 should resolve the issue.